The Kaspersky Digital Footprint Intelligence team presented a new study that reveals ransomware as the most widespread Malware-as-a-Service (MaaS) over the past seven years.

The study is based on research conducted on 97 malware families been distributed on the dark web and other resources. Additionally, the researchers found that cyber criminals often lease infostealers, botnets, loaders, and backdoors to carry out their attacks.

Malware-as-a-Service (MaaS) is an illicit model of business involving the leasing of software to carry out cyber attacks. Typically, clients of such services are offered a personal account through which they can control the attack, as well as technical support. It lowers the initial threshold of expertise needed by would-be cyber criminals, Kaspersky states.

Ransomware to be the most popular Malware-as-a-Service

Kaspersky's experts examined various malware families sale volumes, as well as mentions, discussions, posts, and search ads on the darknet and other resources regarding MaaS to identify the most popular types.

The leader turned out to be ransomware, or malicious software that encrypts data and demands to payment for decryption. It accounted for 58% of all families distributed under the MaaS model between 2015 and 2022.

The popularity of ransomware can be attributed to its ability to generate higher profits in a shorter space of time than other types of malware, Kaspersky states.

Cyber criminals can "subscribe" to Ransomware-as-a-service (RaaS) for free. Once they become partners in the program, they pay for the service after the attack happens. The payment amount is determined by a percentage of the ransom paid by the victim, typically ranging from 10% to 40% of each transaction. However, entering the program is no simple task, as it entails meeting rigorous requirements.

Infostealers accounted for 24% of malware families distributed as a service over the analysed period. These are malicious programs designed to steal data such as credentials, passwords, banking cards and accounts, browser history, crypto wallets data, and more.

Infostealer services are paid through a subscription model. They are priced between US$100-300 per month. For example, Raccoon Stealer, which was discontinued in early February 2023, could be acquired for US$275 per month or US$150 per week. Its competitor, RedLine, has monthly price of US$150, and there is also an option to purchase a lifetime license for US$900, according to the information posted on the Darknet by its operators. Attackers also make use of additional services for extra pay.

Alexander Zabrovsky, Digital Footprint Analyst at Kaspersky, comments, "18% of malware families being sold as a service proved to be botnets, loaders, and backdoors. These threats are combined into one group since they often have a common goal: to upload and run other malware on the victims device. For instance, the price of loader Matanbuchus tends to vary over time. The price in June of the current year starts from US$4900 per month.

"This type of malware is more expensive than infostealers, for example, the malicious code itself is more complex, and the operator provides all the infrastructure, meaning the partners don't have to pay extra for bulletproof hosting services when they use Matanbuchus. It is worth noting that the number of subscribers to Matanbuchus."

Components of MaaS and malefactor hierarchy

The cyber criminals who operate MaaS platforms are commonly referred to as operators, whereas those who purchase these services are known as affiliates, Kaspersky states.

After closing a deal with operators, affiliates receive access to all necessary components of MaaS, such as command-and-control (C2) panels, builders (programs for quick creation of unique malware samples), malware and interface upgrades, support, instructions, and hosting.

The panels are an essential component allowing attackers to control and coordinate the activities of the infected machines. For example, cyber criminals are able to exfiltrate data, negotiate with a victim, contact support, create unique malware samples, and much more, according to the company.

Some types of MaaS, such as infostealers, allow affiliates to create their own kind of team. Members of such a team are called traffers cyber criminals who distribute malware to increase profits and generate interest, bonuses, and other payments from affiliates.

Traffers do not have access to C2 panel or other tools. Their only purpose is to scale up the spread of the malware. Most often, they achieve this by disguising samples as cracks and instructions for hacking legitimate programs on YouTube and other websites, Kaspersky states.

An example of a video used by traffers to spread an infostealer

Zabrovsky comments, "Cyber criminals actively trade illicit goods and services, including malware and stolen data, over the shadow segments of the internet. By understanding how this market is structured, companies can gain insights into the methods and motivations of potential attackers.

"Armed with this information, we are able to better help businesses better develop effective strategies that prevent cyber attacks by identifying and monitoring cyber criminal activities, tracking the flow of information, and keeping up-to-date on emerging threats and trends."

To protect your organisation from related threats, Kaspersky experts recommend:

• Always keep software updated on all the devices you use to prevent attackers from infiltrating your network by exploiting vulnerabilities. Install patches for new vulnerabilities as soon as possible. Once it is downloaded, threat actors can no longer abuse the vulnerability.
• Use the latest Threat Intelligence information to stay aware of actual TTPs used by threat actors. Use a solution to help security analysts explore an adversary's view of their company resources, promptly discover the potential attack vectors available to them. This also helps raise awareness about existing threats from cyber criminals in order to adjust your defenses accordingly or take counter and elimination measures timely.
• If you are faced with an incident, an incident response service will help you respond and minimise the consequences, in particular they can identify compromised nodes and protect the infrastructure from similar attacks in the future.